f6763ffbb4146148c31112f49f31bc335970242f405c7120e71eea0afbb70b61

Analysis

max time kernel
82s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Baidu_Com_90000170.exe
Size

1.4MB
MD5

f34e66fb58d8cace441e9a6fdd9998aa
SHA1

4b719111844a8788ede32bfd0a93ee0ce1e7410f
SHA256

53e01b61ccf9868ab79aad471e84226b2090f8cba87fa0ec0fb487755e8c19d4
SHA512

4d4072ce78398252ae03591bf886ae8602c49dfc8dc33b31de279bde402714c2a91d38c2ec984077a9b67e4610ec9dea213dc02d381382721c2ea42ae6dc9ab0
SSDEEP

24576:+CgIYG5yhyeFZGi9LEoXjpANX4JzOi30lZl8nNyUcyqWWaDwKbTI1yQEKo9gt6K:tYWyhyeF0i9LEoXjMI07+cybWeY1yQE6

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

Baidu_Com_90000170.exe

pid process

1632 Baidu_Com_90000170.exe
1632 Baidu_Com_90000170.exe
1632 Baidu_Com_90000170.exe
1632 Baidu_Com_90000170.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Baidu_Com_90000170.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Baidu_Com_90000170.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1632	Baidu_Com_90000170.exe
1632	Baidu_Com_90000170.exe
1632	Baidu_Com_90000170.exe
1632	Baidu_Com_90000170.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Baidu_Com_90000170.exe

Modifies registry class 3 IoCs

Processes:

Baidu_Com_90000170.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	Baidu_Com_90000170.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	Baidu_Com_90000170.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 98e9bb43f721424180bfc7d0b3477c16	Baidu_Com_90000170.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Baidu_Com_90000170.exe

pid process

1632 Baidu_Com_90000170.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Baidu_Com_90000170.exe

pid process

1632 Baidu_Com_90000170.exe

pid	process
1632	Baidu_Com_90000170.exe

pid	process
1632	Baidu_Com_90000170.exe

C:\Users\Admin\AppData\Local\Temp\Baidu_Com_90000170.exe
"C:\Users\Admin\AppData\Local\Temp\Baidu_Com_90000170.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\BDMDownload.dll
Filesize
158KB

MD5
d184763cb4e62d531193978de7b82db2

SHA1
f4824e6e58f50b1fd89396afa17d0f97d86895f7

SHA256
63a233664064e22fd3260e4dc06293b8fa724e62071ad1cf8af9a4bb453e1dea

SHA512
25bb657827c1c4ce410346e11e60fe954f62100731bd730405cba666d4eb7009dfd394053e2afabfd9981ea0eea5fa625f24805a1d4d24c7da44f6449eda7e1b

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\BDMSkin.dll
Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\dl.dll
Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF4AE.tmp\tmpudtmmm.dll
Filesize
604KB

MD5
b0e13c40c3c7e6bf4efdf6cd74c9942d

SHA1
b1074b324c945d60d02550aba59f9ab10650bd5c

SHA256
46164d8a590fbb24e886238dd4ca5892a5b600905bd62694e89ff19f9256aa14

SHA512
1b94b2bc6bd50e8d423e57618f7d735fd370e407a78ca8907ac90128825252cfc807137c3ce7010c8a3c2311a51a134f1ea63703aecbd96d1e4b1880eefa82e0

Download Submit
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1632-63-0x0000000004C40000-0x0000000004E2D000-memory.dmp

Filesize
1.9MB

Download